Expand ubuntu-latest runner tool baseline

[gjkim42]

What type of PR is this?

/kind feature

What this PR does / why we need it:

Expands the existing open-actions-runner image with the native compiler and libc headers required by cgo plus jq, kubectl, gh, openssl, and nc. The runner keeps its restricted non-root execution profile.

The single maintained Ubuntu runner profile uses the ubuntu-latest label and is currently based on Ubuntu 24.04. The quick start, Docker Runner sample, dev deployment, reference documentation, and end-to-end toolchain workflow use that label consistently. The image contract documents the supported commands, pinned CLI versions, versioning policy, and intentionally unsupported GitHub-hosted VM assumptions.

The existing end-to-end runner workflow discovers every contracted command and runs go test -race after actions/setup-go.

Validation:

• make test
• make verify
• make test TEST_FLAGS='-tags=e2e -run TestDoesNotExist'
• Pinned gh and kubectl download checksum verification

Which issue(s) this PR is related to:

Fixes #142

Special notes for your reviewer:

The change updates the existing standard runner image and uses the existing spec.execution.image and spec.labels fields. It does not add another image or modify the Kubernetes API or CRDs. ubuntu-latest selects the one Open Actions Ubuntu profile, currently Ubuntu 24.04; it does not claim the complete software inventory or VM behavior of GitHub's hosted ubuntu-latest runner.

The full image build and Kind-backed smoke workflow run in CI because Docker is unavailable in the development workspace.

Does this PR introduce a user-facing change?

The standard `ubuntu-latest` runner image now includes native build tools, `jq`, `kubectl`, `gh`, `openssl`, and `nc`.

[gjkim42]

/kelos claude-review

[kelos-bot]

🤖 Kelos Task Status

Task open-actions-claude-reviewer-issue-comment-cb95d19ae5dc has succeeded. ✅

[kelos-bot]

🤖 Open Actions Claude Reviewer Agent @gjkim42

Review Summary

Verdict: APPROVE
Overall correctness: patch is correct
Scope: Expands the standard runner image with build-essential, jq, kubectl, gh, openssl, and nc, documents the image contract and versioning policy, and extends the e2e fixture with tool discovery and a race-enabled Go test.

Findings Overview

Priority	Count	File:Line	Summary
P0	0	—	none
P1	0	—	none
P2	0	—	none
P3	1	examples/runner/Dockerfile:6	Custom-image example installs jq, now part of the standard baseline

Findings

Documentation

• [P3] examples/runner/Dockerfile:6 (mirrored at docs/reference.md:542) — The custom runner image example installs jq, which this PR adds to the standard baseline. The surrounding text was updated to say "A custom runner image can add other tools by extending the standard image", but the example directly below it now demonstrates adding a tool the same section documents as already included, so it no longer shows extension of the image with something it lacks. Switch the example (both the file and the doc snippet) to a tool outside the contract table, such as unzip or rsync; CI already builds examples/runner, so the change stays verified.

Suggestions (optional)

• [P3] test/e2e/runner_test.go:195 / test/fixture/github/main.go:65 — The fixture runs gh --version and kubectl version --client but nothing asserts the output against the versions pinned in the Dockerfile and documented in the contract table (gh 2.98.0, kubectl 1.35.8). Asserting the version strings in the log output (for example ContainSubstring("gh version 2.98.0")) would keep the docs table, Dockerfile ARGs, and shipped image from drifting apart silently on future bumps.

Key takeaways

• The supply-chain-sensitive parts are correct: I verified all four pinned SHA-256 values against the official gh_2.98.0_checksums.txt and dl.k8s.io .sha256 files, and they match for both amd64 and arm64. Unsupported architectures fail the build explicitly, and the image keeps USER 65532:65532 with no sudo.
• The smoke test is sound: run steps execute under bash -e -o pipefail (internal/runner/runner.go:799), so a missing command in the discovery loop or a go test -race failure fails the step, and the runner tool baseline works marker asserted in test/e2e/runner_test.go:195 only prints on full success. The fixture also runs actions/setup-go before the race test, matching the issue's acceptance criterion.
• Scope note: issue Provide an opt-in GitHub-like runner toolchain image #142's acceptance criteria describe an opt-in compatibility image that keeps the current minimal image as the default, while this PR expands the default image itself (growing it for every runner Pod, roughly 250 MB uncompressed from build-essential plus the two CLIs). The PR description declares this intentional and the PR author is the issue author, so it is treated as a scope decision rather than a defect — but the issue text and triage recommendation no longer match the implementation, which is worth acknowledging when closing Provide an opt-in GitHub-like runner toolchain image #142.

[gjkim42]

Reviewed all PR feedback against current head 9f2628a:

• The required P3 documentation finding is resolved: examples/runner/Dockerfile and the mirrored reference snippet both install rsync, which is outside the standard baseline, instead of jq.
• The exact version-output assertion was explicitly optional. No change is required: gh and kubectl are pinned and checksum-verified in the image build, and the E2E workflow executes both version commands.
• Expanding the existing image is the intentional scope decision for this PR. The single maintained Ubuntu profile uses ubuntu-latest, currently maps to Ubuntu 24.04, and does not claim full GitHub-hosted runner parity.

There are no formal reviews, inline comments, or unresolved review threads. The branch is squashed to one commit.